A critical XML External Entity (XXE) injection vulnerability has been discovered in Apache Tika, affecting hundreds of publicly accessible servers worldwide.
CVE-2025-66516, rated at the maximum severity score of CVSS 10.0, poses significant risks to organizations running vulnerable Apache Tika Server instances.
| Field | Details |
|---|---|
| CVE-ID | CVE-2025-66516 (CVSS 10.0) |
| Vulnerability Description | Critical XXE injection vulnerability |
Critical Flaw Enables Multiple Attack Vectors
The vulnerability resides in Apache Tika’s handling of XFA files embedded within PDF documents.
Attackers can exploit this weakness to perform XXE injection attacks, potentially leading to the disclosure of sensitive data, server resource exhaustion through denial-of-service (DoS) attacks, or Server-Side Request Forgery (SSRF) operations.
The flaw affects a wide range of versions, specifically tika-core 1.13.0 through 3.2.1, representing years of vulnerable releases since 2016.
Apache Tika serves as a content detection and extraction framework widely deployed in enterprise environments for document processing and metadata extraction.
Exposing these servers to the public internet magnifies the risk, as attackers can directly target vulnerable instances without requiring internal network access.
Security research firm Censys has identified 565 potentially vulnerable Apache Tika Server instances exposed on the internet at the time of disclosure.
These servers span multiple countries and organizations, creating an attractive target surface for threat actors.
The disclosure occurred on December 4, 2025, through official Apache Software Foundation channels.
Currently, no proof-of-concept exploit code has been publicly released, and no active exploitation has been observed.
However, the critical severity rating and straightforward attack vector suggest exploitation attempts may emerge once technical details become widely available.
Apache has released fixes to address this vulnerability. Organizations running Apache Tika Server should immediately upgrade tika-core to version 3.2.2 or later.
Applications that use Apache Tika as a Maven dependency face additional complexity, as both tika-parsers and tika-pdf-module require updates.
Administrators should upgrade tika-parsers to version 1.28.6 or later, and tika-pdf-module to version 3.2.2 or later.
Detection of vulnerable instances remains challenging, as Censys can only identify exposed Tika Server deployments.
Applications embedding Tika as a library dependency may remain vulnerable without appearing in public scans, potentially leaving the actual exposure significantly higher than reported.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
 injection vulnerability has been discovered in Apache Tika, affecting hundreds of publicly accessible servers worldwide.){kind=link}